remcos | f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774

Analysis

max time kernel
60s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774.exe
Size 124KB
Sample261111-y7jf8a1xfs
SHA256 f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774
MD5 8e2c50a72be7f7be264bafd7b5c810d9
SHA1 f595f4e00049c4a0366b7cb85e5e658d28c6d0bc
SHA512 5b0670e047776247f08a88db9694df2b8ea20a6bf3f2392b743dada37cfdee386c17e3c5fb1cc8daa72f7a0e0b4c2d6f74bef84c82b927f7b30064fd252cef10
SSDEEP 1536:F9QYtE1FJz3/6T8tf5ey+HS/PCHHV2r1k2rKiIdEdJY+zqh7lMQ/da0E:rQCENiny+HSiHHVY1k29IiJY+zQMQ3
TLSH
T14DC3F7077306D5A3E42782B017817F92DABCECA20A366153C3E8D5911E7985AF43767F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remcos rat

Malware Config

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4332	f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774.exe

C:\Users\Admin\AppData\Local\Temp\f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774.exe
"C:\Users\Admin\AppData\Local\Temp\f78fc5c2c85b030e570d2c988d36c988384cce77167121cfa969a3a1fb617774.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Size 79B
SHA256 2e1b234585d26c03021e632e6abeabe0aa76f998087744a383d8b58368e51103
MD5 e9644a27d580883b353915121bfe73bf
SHA1 2ebec339015e783334f02bb07aa53abcc8cf972a
SHA512 a6fc03b108689562d6c24fcf0c4631b3785c42d31e041782ad333f350f6604d4f7ea15021463aa4328740461edcdf7185077b71631113b8106eb3521665d72d9
TLSH
T106A012449230C940001028E071483057A04215123966544560428B0C03481116580122
MD5 SHA1 SHA512 TLSH

Submit Download